fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and all 14 tsc --noEmit type errors in the repository. Final state: 22 tests pass, 0 fail; tsc --noEmit exits clean.

The bugs spanned both the api (Hono HTTP server) and shared (types/utilities) packages.

Changes

• Auth middleware (packages/api/src/middleware/auth.ts) — fixed a case-sensitivity bug: the public-methods list contained "post" (lowercase). c.req.method is always uppercase per RFC 7231, so POST /users was incorrectly requiring a token (401). Corrected to ["GET", "POST"].
• Shared types (packages/shared/src/types.ts) — renamed User.userName → username to match what the tests and route handlers use. This was the single source of 5 cross-package type errors; the tests (which must not change) reference username in 9 places.
• Pagination utility (packages/shared/src/utils/pagination.ts) — implemented the previously-stubbed paginate() per the test contract: page is 1-indexed and echoed back unclamped (out-of-range page yields empty data), totalPages is 0 for an empty array.
• Users route (packages/api/src/routes/users.ts) — imported the missing badRequest helper from ../lib/errors (it was called but never imported, causing a ReferenceError / 500 instead of 400 on invalid POST bodies).
• tsconfig.json — added "types": ["bun-types"] so bun:test and the process global resolve. bun-types was already a devDependency; no new dependencies added.

Verification

• bun test → 22 pass / 0 fail
• npx tsc --noEmit → exit 0, zero errors

Constraints honoured

• No test files modified
• No new dependencies added; no package.json changes
• Only source/config fixes required by the tests

Notes / observations (out of scope, not changed)

The auth policy makes POST /users public and compares the bearer token with a hardcoded "test-token" fallback when API_TOKEN is unset. The tests encode this behaviour, so it was left as-is — but for a production deployment, consider failing closed when API_TOKEN is unset and using a constant-time comparison for the token.